Description (CNA)
The Export All URLs WordPress plugin before 5.1 generates CSV filenames containing posts URLS (including private posts) in a predictable pattern using a random 6-digit number. These files are stored in the publicly accessible wp-content/uploads/ directory. As a result, any unauthenticated user can brute-force the filenames to gain access to sensitive data contained within the exported files.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / Export All URLs | affected 0 before 5.1 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No references supplied.